CVE-2025-47940 Overview
CVE-2025-47940 is a privilege escalation vulnerability in TYPO3, an open source PHP-based web content management system. The flaw allows administrator-level backend users without system maintainer privileges to escalate their access and obtain system maintainer rights. Exploitation requires a valid administrator account, limiting the attack surface to authenticated users with elevated access.
The vulnerability affects TYPO3 versions from 10.0.0 up to (but not including) 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS. The weakness is classified under [CWE-283: Unverified Ownership]. TYPO3 published the issue in advisory TYPO3-Core-SA-2025-016.
Critical Impact
An authenticated administrator can gain system maintainer privileges, granting full control over TYPO3 system configuration, extensions, and underlying application settings.
Affected Products
- TYPO3 versions 10.0.0 through 10.4.49 (fixed in 10.4.50 ELTS)
- TYPO3 versions 11.0.0 through 11.5.43 (fixed in 11.5.44 ELTS)
- TYPO3 versions 12.0.0 through 12.4.30 and 13.0.0 through 13.4.11 (fixed in 12.4.31 LTS and 13.4.12 LTS)
Discovery Timeline
- 2025-05-20 - CVE-2025-47940 published to the National Vulnerability Database
- 2025-09-03 - Last updated in NVD database
Technical Details for CVE-2025-47940
Vulnerability Analysis
TYPO3 distinguishes between standard administrator accounts and system maintainer accounts. System maintainers hold the highest privilege tier and can modify install-tool settings, manage extensions, and adjust core configuration. The CMS is expected to enforce a strict ownership and membership check before granting maintainer-only functionality.
In affected versions, the backend fails to consistently validate whether an administrator user belongs to the configured systemMaintainers list. An administrator can perform actions or trigger workflows that elevate their effective role to system maintainer. Once elevated, the attacker inherits unrestricted control over the TYPO3 installation.
Exploitation requires high privileges (a valid administrator session) and network access to the backend. No user interaction is necessary. Successful exploitation impacts confidentiality, integrity, and availability of the application and any data it manages.
Root Cause
The weakness maps to [CWE-283: Unverified Ownership]. The application accepts administrator-driven operations without verifying that the requesting account is an authorized system maintainer. Authorization logic relies on role assumptions rather than explicit membership checks against the maintainer list.
Attack Vector
An attacker who controls an administrator account authenticates to the TYPO3 backend over the network. The attacker invokes the affected administrative workflow that lacks proper ownership verification. The backend processes the request as if the user were a system maintainer, granting access to install-tool features and configuration normally restricted to that role. From there, the attacker can install extensions, alter configuration, or stage further compromise such as code execution through trusted extension upload paths.
Refer to the TYPO3 Security Advisory TYPO3-Core-SA-2025-016 and the GitHub Security Advisory GHSA-6frx-j292-c844 for vendor-supplied technical details.
Detection Methods for CVE-2025-47940
Indicators of Compromise
- Unexpected changes to the SYS/systemMaintainers array in LocalConfiguration.php or settings.php.
- New extensions installed or updated by administrator accounts that are not listed as system maintainers.
- Backend audit log entries showing install-tool access from non-maintainer administrator user IDs.
- Modifications to system configuration files outside of approved change windows.
Detection Strategies
- Compare the current systemMaintainers list against a known-good baseline and alert on additions.
- Review TYPO3 sys_log and BE/lockIP records for administrator sessions that accessed /typo3/install/ endpoints.
- Correlate web server access logs for requests to the install tool from accounts not authorized as maintainers.
Monitoring Recommendations
- Enable file integrity monitoring on TYPO3 configuration files and the typo3conf/ directory.
- Forward TYPO3 backend logs and web server logs to a centralized SIEM for correlation and retention.
- Alert on extension installation events, especially those originating from administrator accounts following recent privilege changes.
How to Mitigate CVE-2025-47940
Immediate Actions Required
- Upgrade TYPO3 to a patched release: 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS.
- Audit all administrator accounts and remove any that are unnecessary or inactive.
- Review the systemMaintainers configuration and confirm only intended user IDs are listed.
- Rotate credentials for administrator accounts if compromise is suspected.
Patch Information
TYPO3 released fixed versions on the LTS and ELTS branches. Apply 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS depending on your deployment. The patches enforce proper ownership verification before granting system maintainer functionality. See the GitHub Security Advisory GHSA-6frx-j292-c844 for the upstream commits.
Workarounds
- Restrict administrator account creation to a minimal set of trusted users until patches are applied.
- Limit backend access by IP through BE/lockIP or upstream network controls.
- Enforce multi-factor authentication on all administrator accounts to reduce the risk of credential abuse.
- Monitor configuration files and the install tool for unauthorized changes until upgrade is complete.
# Update TYPO3 via Composer to a patched release
composer require typo3/cms-core:^13.4.12 --update-with-dependencies
# Verify installed version
./vendor/bin/typo3 --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
